feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/003_create_events.sql

@@ -0,0 +1,43 @@
+-- Migration 003: Create events table
+-- UP
+BEGIN;
+
+CREATE TYPE event_status   AS ENUM ('draft', 'published', 'cancelled', 'completed');
+CREATE TYPE kashrut_level  AS ENUM ('none', 'regular', 'mehadrin', 'chalav_yisrael');
+CREATE TYPE event_language AS ENUM ('hebrew', 'arabic', 'english');
+
+CREATE TABLE events (
+  id                   UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
+  organizer_id         UUID         NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  title                VARCHAR(255) NOT NULL,
+  description          TEXT,
+  event_date           TIMESTAMPTZ,
+  venue_name           VARCHAR(255),
+  venue_address        TEXT,
+  max_guests           INTEGER,
+  venue_capacity       INTEGER,                          -- fire-safety hard limit
+  max_plus_ones_buffer INTEGER      NOT NULL DEFAULT 30, -- % buffer for walk-ins
+  status               event_status NOT NULL DEFAULT 'draft',
+  kashrut_level        kashrut_level NOT NULL DEFAULT 'none',
+  noise_curfew_time    TIME         NOT NULL DEFAULT '23:00',  -- Israeli law default
+  language_pref        event_language NOT NULL DEFAULT 'hebrew',
+  budget               DECIMAL(12, 2),
+  retention_policy_days INTEGER     NOT NULL DEFAULT 365, -- Israeli Privacy Law 2023
+  deleted_at           TIMESTAMPTZ,                       -- soft delete for organizer use
+  created_at           TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  updated_at           TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_events_organizer_id ON events(organizer_id);
+CREATE INDEX idx_events_status       ON events(status);
+CREATE INDEX idx_events_event_date   ON events(event_date);
+
+COMMIT;
+
+-- DOWN
+-- BEGIN;
+-- DROP TABLE IF EXISTS events;
+-- DROP TYPE IF EXISTS event_language;
+-- DROP TYPE IF EXISTS kashrut_level;
+-- DROP TYPE IF EXISTS event_status;
+-- COMMIT;